Sources European Data Protection Board (EDPB) Article 29 Working Party (WP29) Court of Justice of the European Union (CJEU) General Data Protection Regulation (GDPR)